Privacy and data
This page summarizes how data is handled. The privacy policy, the data processing agreement and the sub-processors list are the binding texts.
Your content is never stored
Images and texts are checked in memory and forgotten when the answer is sent. There is no copy, no thumbnail, no excerpt and no hash of them, in logs or anywhere else. Nothing holds your content in a queue, and it is not used to train models.
On paid plans, the advanced AI workflows also send a text that the first check sends to review, with its context, to a sub-processor in the United States. The privacy policy says who it is and what it keeps.
For the personal data your content may hold, Sway SRL is your processor: it processes the content only to return the decision, on your instructions.
What is kept
| Data | Holds | Kept |
|---|---|---|
| The decision journal | For each check: the time, the request id, the key, the kind, the workflow and its version, the decision, the reasons with scores and thresholds, the duration, the size and your ref. Never the content. | 7 days on the free plan, 30 days on paid plans |
| Usage counters | Checks per hour, key, workflow and kind. | While the organization exists |
| Account and organization | Email addresses, names, members and roles, plan, workflows, keys (as hashes only). | While the organization exists |
| Dashboard sessions | For each browser signed in: its IP address, its browser and when it signed in. | Until the session expires or you sign out |
| Audit log | Who changed what in the dashboard, with the network prefix of their IP address (IPv4 /24 or IPv6 /48), never the full address. | While the organization exists |
| Billing | Handled by Stripe; invoices are kept as accounting law requires. | See the privacy policy |
The journal never stores the IP address or the browser of your users, only what you send in ref.
Where it runs
- The databases and the file storage are in the European Union.
- The checking server is in the European Union.
- The website, the dashboard and the front door of the API are delivered through Cloudflare's network, so a request is handled in the Cloudflare location closest to the sender.
Your data, your exit
You can export your workflows (JSON), your journal (JSONL or CSV) and your usage (CSV) at any time from the dashboard. When you delete your organization, the keys stop at once and your data stays available for 30 days so that you can take it out, then it is erased.
Questions
Write to contact@sway.events.